Read Deck due dates as UTC regardless of PHP's default timezone

Deck stores duedate as a zoneless DATETIME holding UTC wall-clock time,
and Entity hydrates it in PHP's default zone. That is only correct
because Nextcloud forces the default to UTC; pin the wall clock to UTC
explicitly so the overdue check compares real instants either way.

lib/Service/WorkflowRunner.php

@@ -4,7 +4,9 @@ declare(strict_types=1);
 
 namespace OCA\WorkflowDeckAutomation\Service;
 
+use DateTimeImmutable;
 use DateTimeInterface;
+use DateTimeZone;
 use OCA\Deck\Db\Card;
 use OCA\WorkflowDeckAutomation\Db\Workflow;
 use OCA\WorkflowDeckAutomation\Db\WorkflowMapper;
@@ -325,9 +327,31 @@ class WorkflowRunner {
 	 * every card for up to 24h after it actually fell due; comparing the raw datetime
 	 * instead matches what Deck's own UI shows (e.g. "vor 2 Stunden") and has no
 	 * day-rounding step to get wrong.
+	 *
+	 * Both sides are compared as absolute instants, and the due date is first
+	 * pinned to UTC via asStoredUtc() — see there for why.
 	 */
 	public static function isOverdue(?DateTimeInterface $duedate, DateTimeInterface $now): bool {
-		return $duedate !== null && $duedate < $now;
+		return $duedate !== null && self::asStoredUtc($duedate) < $now;
+	}
+
+	/**
+	 * Deck's `duedate` is a DATETIME column without a zone that holds UTC
+	 * wall-clock time: Deck's frontend sends `toISOString()`, and the value is
+	 * written as plain `Y-m-d H:i:s`. Entity hydrates it with
+	 * `new \DateTime($string)`, i.e. in PHP's *default* timezone — correct only
+	 * because Nextcloud sets that default to UTC during bootstrap. Reading the
+	 * wall clock and pinning it to UTC explicitly makes the comparison
+	 * independent of that default, so a server or CLI running with a local
+	 * default zone cannot shift every due date by its UTC offset.
+	 *
+	 * Deck itself has two timezone-sensitive paths this deliberately avoids:
+	 * Card::getDaysUntilDue() (day-truncated, see isOverdue()) and
+	 * CardMapper::findOverdue(), which compares the UTC column against the
+	 * database's `NOW()` — the DB session's local time.
+	 */
+	private static function asStoredUtc(DateTimeInterface $duedate): DateTimeImmutable {
+		return new DateTimeImmutable($duedate->format('Y-m-d H:i:s.u'), new DateTimeZone('UTC'));
 	}
 
 	/**